<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <title>JSDoc: Class: Passwordless</title>

    <script src="scripts/prettify/prettify.js"> </script>
    <script src="scripts/prettify/lang-css.js"> </script>
    <!--[if lt IE 9]>
      <script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script>
    <![endif]-->
    <link type="text/css" rel="stylesheet" href="styles/prettify-tomorrow.css">
    <link type="text/css" rel="stylesheet" href="styles/jsdoc-default.css">
</head>

<body>

<div id="main">

    <h1 class="page-title">Class: Passwordless</h1>

    




<section>

<header>
    
        <h2>Passwordless</h2>
        
    
</header>

<article>
    <div class="container-overview">
    
        

    

    <h4 class="name" id="Passwordless"><span class="type-signature"></span>new Passwordless<span class="signature">()</span><span class="type-signature"></span></h4>

    



<div class="description">
    Passwordless is a node.js module for express that allows authentication and 
authorization without passwords but simply by sending tokens via email or 
other means. It utilizes a very similar mechanism as many sites use for 
resetting passwords. The module was inspired by Justin Balthrop's article 
"Passwords are Obsolete"
</div>













<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line15">line 15</a>
    </li></ul></dd>
    

    

    

    
</dl>
















    
    </div>

    

    

    

     

    

    

    
        <h3 class="subsection-title">Methods</h3>

        
            

    

    <h4 class="name" id="_generateNumberToken"><span class="type-signature">(private) </span>_generateNumberToken<span class="signature">(max)</span><span class="type-signature"> &rarr; {Number}</span></h4>

    



<div class="description">
    Generates a strong random number between 0 and a maximum value. The
maximum value cannot exceed 2^32
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>max</code></td>
            

            <td class="type">
            
                
<span class="param-type">Number</span>


            
            </td>

            

            

            <td class="description last">Maximum number to be generated</td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line640">line 640</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error if there is no sufficient
entropy accumulated
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    


<h5>Returns:</h5>

        
<div class="param-desc">
    Random number between 0 and max
</div>



<dl>
    <dt>
        Type
    </dt>
    <dd>
        
<span class="param-type">Number</span>


    </dd>
</dl>

    



        
            

    

    <h4 class="name" id="_generateToken"><span class="type-signature">(private) </span>_generateToken<span class="signature">(randomBytes)</span><span class="type-signature"> &rarr; {function}</span></h4>

    



<div class="description">
    Generates a random token using Node's crypto rng
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>randomBytes</code></td>
            

            <td class="type">
            
                
<span class="param-type">Number</span>


            
            </td>

            

            

            <td class="description last">Random bytes to be generated</td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line623">line 623</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error if there is no sufficient
entropy accumulated
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    


<h5>Returns:</h5>

        
<div class="param-desc">
    token-generator function
</div>



<dl>
    <dt>
        Type
    </dt>
    <dd>
        
<span class="param-type">function</span>


    </dd>
</dl>

    



        
            

    

    <h4 class="name" id="_redirectWithSessionSave"><span class="type-signature">(private) </span>_redirectWithSessionSave<span class="signature">(req, res, next, target)</span><span class="type-signature"></span></h4>

    



<div class="description">
    Avoids a bug in express that might lead to a redirect
before the session is actually saved
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>req</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            

            

            <td class="description last">Node's http req object</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>res</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            

            

            <td class="description last">Node's http res object</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>next</code></td>
            

            <td class="type">
            
                
<span class="param-type">function</span>


            
            </td>

            

            

            <td class="description last">Middleware callback</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>target</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            

            

            <td class="description last">URL to redirect to</td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line601">line 601</a>
    </li></ul></dd>
    

    

    

    
</dl>
















        
            

    

    <h4 class="name" id="_send401"><span class="type-signature">(private) </span>_send401<span class="signature">(res)</span><span class="type-signature"></span></h4>

    



<div class="description">
    Sends a 401 error message back to the user
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>res</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            

            

            <td class="description last">Node's http res object</td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line584">line 584</a>
    </li></ul></dd>
    

    

    

    
</dl>
















        
            

    

    <h4 class="name" id="acceptToken"><span class="type-signature"></span>acceptToken<span class="signature">(options<span class="signature-attributes">opt</span>)</span><span class="type-signature"> &rarr; {<a href="global.html#ExpressMiddleware">ExpressMiddleware</a>}</span></h4>

    



<div class="description">
    Returns express middleware which will look for token / UID query parameters and
authenticate the user if they are provided and valid. A typical URL that is
accepted by acceptToken() does look like this:
http://www.example.com?token=TOKEN&uid=UID
Simply calls the next middleware in case no token / uid has been submitted or if
the supplied token / uid are not valid
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>options</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">
                <h6>Properties</h6>
                

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>successRedirect</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If set, the user will be redirected
to the supplied URL in case of a successful authentication. If not set but the 
authentication has been successful, the next middleware will be called. This 
option is overwritten by option.enableOriginRedirect if set and an origin has 
been supplied. It is strongly recommended to set this option to avoid leaking 
valid tokens via the HTTP referrer. In case of session-less operation, though, 
you might want to ignore this flag for efficient operation (default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>tokenField</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The query parameter used to submit the
token (default: 'token')</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>uidField</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The query parameter used to submit the 
user id (default: 'uid')</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>allowPost</code></td>
            

            <td class="type">
            
                
<span class="param-type">Boolean</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If set, acceptToken() will also look for
POST parameters to contain the token and uid (default: false)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>failureFlash</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The error message to be flashed in case
a token and uid were provided but the authentication failed. Using this option
requires flash middleware such as connect-flash. The error message will be stored
as 'passwordless' (example: 'This token is not valid anymore!', default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>successFlash</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The success message to be flashed in case
the supplied token and uid were accepted. Using this option requires flash middleware 
such as connect-flash. The success message will be stored as 'passwordless-success' 
(example: 'You are now logged in!', default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>enableOriginRedirect</code></td>
            

            <td class="type">
            
                
<span class="param-type">Boolean</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If set to true, the user will
be redirected to the URL he originally requested before he was redirected to the 
login page. Requires that the URL was stored in the TokenStore when requesting a
token through requestToken() (default: false)</td>
        </tr>

    
    </tbody>
</table>

            </td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line95">line 95</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error if there is no valid TokenStore, if failureFlash
or successFlash is used without flash middleware or allowPost is used without body 
parser middleware
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    


<h5>Returns:</h5>

        
<div class="param-desc">
    Express middleware
</div>



<dl>
    <dt>
        Type
    </dt>
    <dd>
        
<span class="param-type"><a href="global.html#ExpressMiddleware">ExpressMiddleware</a></span>


    </dd>
</dl>

    


    <h5>Example</h5>
    
    <pre class="prettyprint"><code>app.use(passwordless.sessionSupport());
// Look for tokens in any URL requested from the server
app.use(passwordless.acceptToken());
		</code></pre>



        
            

    

    <h4 class="name" id="addDelivery"><span class="type-signature"></span>addDelivery<span class="signature">(name<span class="signature-attributes">opt</span>, sendToken, options<span class="signature-attributes">opt</span>)</span><span class="type-signature"></span></h4>

    



<div class="description">
    Adds a new delivery method to Passwordless used to transmit tokens to the user. This could, 
for example, be an email client or a sms client. If only one method is used, no name has to 
provided as it will be the default delivery method. If several methods are used and added, 
they will have to be named.
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>name</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">Name of the strategy. Not needed if only one method is added</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>sendToken</code></td>
            

            <td class="type">
            
                
<span class="param-type"><a href="global.html#sendToken">sendToken</a></span>


            
            </td>

            
                <td class="attributes">
                

                

                
                </td>
            

            

            <td class="description last">Method that will be called as
function(tokenToSend, uidToSend, recipient, callback, req) to transmit the token to the 
user. tokenToSend contains the token, uidToSend the UID that has to be part of the 
token URL, recipient contains the target such as an email address or a phone number 
depending on the user input, and callback has to be called either with no parameters 
or with callback({String}) in case of any issues during delivery</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>options</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">
                <h6>Properties</h6>
                

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>ttl</code></td>
            

            <td class="type">
            
                
<span class="param-type">Number</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">Duration in ms that the token shall be valid 
(example: 1000*60*30, default: 1 hour)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>tokenAlgorithm</code></td>
            

            <td class="type">
            
                
<span class="param-type">function</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The algorithm used to generate a token. 
Function shall return the token in sync mode (default: Base58 token)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>numberToken.max</code></td>
            

            <td class="type">
            
                
<span class="param-type">Number</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">Overwrites the default token generator
by a random number generator which generates numbers between 0 and max. Cannot be used
together with options.tokenAlgorithm</td>
        </tr>

    
    </tbody>
</table>

            </td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line538">line 538</a>
    </li></ul></dd>
    

    

    

    
</dl>















    <h5>Example</h5>
    
    <pre class="prettyprint"><code>passwordless.init(new MongoStore(pathToMongoDb));
passwordless.addDelivery(
	function(tokenToSend, uidToSend, recipient, callback, req) {
		// Send out token
		smtpServer.send({
			text:    'Hello!\nYou can now access your account here: ' 
				+ host + '?token=' + tokenToSend + '&amp;uid=' + encodeURIComponent(uidToSend), 
			from:    yourEmail, 
			to:      recipient,
			subject: 'Token for ' + host
		}, function(err, message) { 
			if(err) {
				console.log(err);
			}
			callback(err);
		});
	});
	</code></pre>



        
            

    

    <h4 class="name" id="init"><span class="type-signature"></span>init<span class="signature">(tokenStore, options<span class="signature-attributes">opt</span>)</span><span class="type-signature"></span></h4>

    



<div class="description">
    Initializes Passwordless and has to be called before any methods are called
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>tokenStore</code></td>
            

            <td class="type">
            
                
<span class="param-type">TokenStore</span>


            
            </td>

            
                <td class="attributes">
                

                

                
                </td>
            

            

            <td class="description last">An instance of a TokenStore used to store
and authenticate the generated tokens</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>options</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">
                <h6>Properties</h6>
                

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>userProperty</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">Sets the name under which the uid 
is stored in the http request object (default: 'user')</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>allowTokenReuse</code></td>
            

            <td class="type">
            
                
<span class="param-type">Boolean</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">Defines wether a token may be
reused by users. Enabling this option is usually required for stateless
operation, but generally not recommended due to the risk that others might
have acquired knowledge about the token while in transit (default: false)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>skipForceSessionSave</code></td>
            

            <td class="type">
            
                
<span class="param-type">Boolean</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">Some session middleware
(especially cookie-session) does not require (and support) the forced
safe of a session. In this case set this option to 'true' (default: false)</td>
        </tr>

    
    </tbody>
</table>

            </td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line39">line 39</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error if called without an instantiated 
TokenStore
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    





        
            

    

    <h4 class="name" id="logout"><span class="type-signature"></span>logout<span class="signature">(options<span class="signature-attributes">opt</span>)</span><span class="type-signature"> &rarr; {<a href="global.html#ExpressMiddleware">ExpressMiddleware</a>}</span></h4>

    



<div class="description">
    Logs out the current user and invalidates any tokens that are still valid for the user
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>options</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">
                <h6>Properties</h6>
                

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>successFlash</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The success message to be flashed in case
has been logged in an the logout proceeded successfully. Using this option requires 
flash middleware such as connect-flash. The success message will be stored as 
'passwordless-success'. (example: 'You are now logged in!', default: null)</td>
        </tr>

    
    </tbody>
</table>

            </td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line256">line 256</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error if successFlash is used without flash middleware
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    


<h5>Returns:</h5>

        
<div class="param-desc">
    Express middleware
</div>



<dl>
    <dt>
        Type
    </dt>
    <dd>
        
<span class="param-type"><a href="global.html#ExpressMiddleware">ExpressMiddleware</a></span>


    </dd>
</dl>

    


    <h5>Example</h5>
    
    <pre class="prettyprint"><code>router.get('/logout', passwordless.logout( {options.successFlash: 'All done!'} ),
	function(req, res) {
		res.redirect('/');
});
		</code></pre>



        
            

    

    <h4 class="name" id="requestToken"><span class="type-signature"></span>requestToken<span class="signature">(getUserID, options<span class="signature-attributes">opt</span>)</span><span class="type-signature"> &rarr; {<a href="global.html#ExpressMiddleware">ExpressMiddleware</a>}</span></h4>

    



<div class="description">
    Requests a token from Passwordless for a specific user and calls the delivery strategy 
to send the token to the user. Sends back a 401 error message if the user is not valid 
or a 400 error message if no user information has been transmitted at all. By default,
POST params will be expected
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>getUserID</code></td>
            

            <td class="type">
            
                
<span class="param-type"><a href="global.html#getUserID">getUserID</a></span>


            
            </td>

            
                <td class="attributes">
                

                

                
                </td>
            

            

            <td class="description last">The function called to resolve the supplied user contact 
information (e.g. email) into a proper user ID: function(user, delivery, callback, req)
where user contains the contact details provided, delivery the method used, callback 
expects a call in the format callback(error, user), where error is either null or an 
error message and user is either null if not user has been found or the user ID. req 
contains the Express request object</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>options</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">
                <h6>Properties</h6>
                

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>failureRedirect</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If provided, the user will be redirected
to the given URL in case the user details were not provided or could not be validated
by getUserId. This could typically by a login page (example: '/login', default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>failureFlash</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The error message to be flashed in case
the user details could not be validated. Using this option requires flash middleware 
such as connect-flash. The message will be stored as 'passwordless'. Can only be used 
in combination with failureRedirect (example: 'Your user details seem strange', 
default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>successFlash</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The message to be flashed in case the tokens
were send out successfully. Using this option requires flash middleware such as 
connect-flash. The message will be stored as 'passwordless-success '. 
(example: 'Your token has been send', default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>userField</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The field which contains the user's contact 
detail such as her email address (default: 'user')</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>deliveryField</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The field which contains the name of the
delivery method to be used. Only needed if several strategies have been added with
addDelivery() (default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>originField</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If set, requestToken() will look for any
URLs in this field that will be stored in the token database so that the user can
be redirected to this URL as soon as she is authenticated. Usually used to redirect 
the user to the resource that she originally requested before being redirected to
the login page (default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>allowGet</code></td>
            

            <td class="type">
            
                
<span class="param-type">Boolean</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If set, requestToken() will look for GET 
parameters instead of POST (default: false)</td>
        </tr>

    
    </tbody>
</table>

            </td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line379">line 379</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error if failureFlash is used without flash middleware, 
failureFlash is used without failureRedirect, successFlash is used without flash 
middleware, no body parser is used and POST parameters are expected, or if no 
delivery method has been added
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    


<h5>Returns:</h5>

        
<div class="param-desc">
    Express middleware
</div>



<dl>
    <dt>
        Type
    </dt>
    <dd>
        
<span class="param-type"><a href="global.html#ExpressMiddleware">ExpressMiddleware</a></span>


    </dd>
</dl>

    


    <h5>Example</h5>
    
    <pre class="prettyprint"><code>router.post('/sendtoken', 
	passwordless.requestToken(
		function(user, delivery, callback, req) {
			// usually you would want something like:
			User.find({email: user}, callback(ret) {
				if(ret)
					callback(null, ret.id)
				else
					callback(null, null)
			})
		}),
		function(req, res) {
			res.render('sent');
		});</code></pre>



        
            

    

    <h4 class="name" id="restricted"><span class="type-signature"></span>restricted<span class="signature">(options<span class="signature-attributes">opt</span>)</span><span class="type-signature"> &rarr; {<a href="global.html#ExpressMiddleware">ExpressMiddleware</a>}</span></h4>

    



<div class="description">
    Returns express middleware that ensures that only successfully authenticated users
have access to any middleware or responses that follows this middleware. Can either
be used for individual URLs or a certain path and any sub-elements. By default, a
401 error message is returned if the user has no access to the underlying resource.
</div>









    <h5>Parameters:</h5>
    

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>options</code></td>
            

            <td class="type">
            
                
<span class="param-type">Object</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">
                <h6>Properties</h6>
                

<table class="params">
    <thead>
    <tr>
        
        <th>Name</th>
        

        <th>Type</th>

        
        <th>Attributes</th>
        

        

        <th class="last">Description</th>
    </tr>
    </thead>

    <tbody>
    

        <tr>
            
                <td class="name"><code>failureRedirect</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If provided, the user will be redirected
to the given URL in case she is not authenticated. This would typically by a login 
page (example: '/login', default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>failureFlash</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">The error message to be flashed in case
the user is not authenticated. Using this option requires flash middleware such as 
connect-flash. The message will be stored as 'passwordless'. Can only be used in
combination with failureRedirect (example: 'No access!', default: null)</td>
        </tr>

    

        <tr>
            
                <td class="name"><code>originField</code></td>
            

            <td class="type">
            
                
<span class="param-type">String</span>


            
            </td>

            
                <td class="attributes">
                
                    &lt;optional><br>
                

                

                
                </td>
            

            

            <td class="description last">If set, the originally requested URL will
be passed as query param (with the supplied name) to the redirect URL provided by
failureRedirect. Can only be used in combination with failureRedirect (example: 
'origin', default: null)</td>
        </tr>

    
    </tbody>
</table>

            </td>
        </tr>

    
    </tbody>
</table>






<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line200">line 200</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error if failureFlash is used without flash middleware, 
failureFlash is used without failureRedirect, or originField is used without 
failureRedirect
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    


<h5>Returns:</h5>

        
<div class="param-desc">
    Express middleware
</div>



<dl>
    <dt>
        Type
    </dt>
    <dd>
        
<span class="param-type"><a href="global.html#ExpressMiddleware">ExpressMiddleware</a></span>


    </dd>
</dl>

    


    <h5>Example</h5>
    
    <pre class="prettyprint"><code>router.get('/admin', passwordless.restricted({ failureRedirect: '/login' }),
	function(req, res) {
 	res.render('admin', { user: req.user });
	});
			</code></pre>



        
            

    

    <h4 class="name" id="sessionSupport"><span class="type-signature"></span>sessionSupport<span class="signature">()</span><span class="type-signature"> &rarr; {<a href="global.html#ExpressMiddleware">ExpressMiddleware</a>}</span></h4>

    



<div class="description">
    By adding this middleware function to a route, Passwordless automatically restores
the logged in user from the session. In 90% of the cases, this is what is required. 
However, Passwordless can also work without session support in a stateless mode.
</div>













<dl class="details">

    

    

    

    

    

    

    

    

    

    

    

    

    
    <dt class="tag-source">Source:</dt>
    <dd class="tag-source"><ul class="dummy"><li>
        <a href="passwordless.js.html">passwordless.js</a>, <a href="passwordless.js.html#line298">line 298</a>
    </li></ul></dd>
    

    

    

    
</dl>











<h5>Throws:</h5>

        

<dl>
    <dt>
        <div class="param-desc">
        Will throw an error no session middleware has been supplied
        </div>
    </dt>
    <dd></dd>
    <dt>
        <dl>
            <dt>
                Type
            </dt>
            <dd>
                
<span class="param-type">Error</span>


            </dd>
        </dl>
    </dt>
    <dd></dd>
</dl>


    


<h5>Returns:</h5>

        
<div class="param-desc">
    Express middleware
</div>



<dl>
    <dt>
        Type
    </dt>
    <dd>
        
<span class="param-type"><a href="global.html#ExpressMiddleware">ExpressMiddleware</a></span>


    </dd>
</dl>

    


    <h5>Example</h5>
    
    <pre class="prettyprint"><code>var app = express();
var passwordless = new Passwordless(new DBTokenStore());
		
app.use(cookieParser());
app.use(expressSession({ secret: '42' }));
		
app.use(passwordless.sessionSupport());
app.use(passwordless.acceptToken());</code></pre>



        
    

    

    
</article>

</section>




</div>

<nav>
    <h2><a href="index.html">Home</a></h2><h3>Classes</h3><ul><li><a href="Passwordless.html">Passwordless</a></li></ul><h3>Global</h3><ul><li><a href="global.html#ExpressMiddleware">ExpressMiddleware</a></li></ul>
</nav>

<br class="clear">

<footer>
    Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.4.0</a> on Sat Mar 05 2016 18:53:04 GMT+0100 (CET)
</footer>

<script> prettyPrint(); </script>
<script src="scripts/linenumber.js"> </script>
</body>
</html>